[tillrohrmann]

Summary

Replaces the copied job in verify-lockfile.yml with a call to the shared workflow in restatedev/restate (restatedev/restate#5721):

jobs:
  verify:
    uses: restatedev/restate/.github/workflows/verify-lockfile.yml@main

The gh-actions-lock version is then maintained in one place for all restatedev repositories. Dependabot can't bump it because it is a CLI argument (gh extension install github/gh-actions-lock --pin v0.4.0), not a uses: reference. The workflow name and triggers stay as they are.

• actions.lock is relocked: the verify-lockfile.yml entry no longer lists actions/checkout, which is now covered by restatedev/restate's own lockfile.
• The check is now reported as verify / verify instead of verify. No branch protection or ruleset in this repository requires the old name.
• taiki-e/install-action@nextest → @v2.89.0 with tool: nextest. The nextest ref is re-pointed to new commits on every release, so the locked commit is no longer in the action repo's history and the lockfile check fails (unreachable pin) from the next run on main onward. The version tag doesn't move; it still installs the latest nextest.

Test plan

• gh actions-lock relock: all workflows valid
• verify / verify passes on this PR (the shared workflow already passes in the 10 Wave 1 repositories, e.g. Add GitHub Actions workflow lockfile e2e#462)

🤖 Generated with Claude Code

[github-actions]

Test Results

  8 files  ±0    8 suites  ±0   3m 37s ⏱️ +11s
 52 tests ±0   52 ✅ ±0  0 💤 ±0  0 ❌ ±0 
227 runs  ±0  227 ✅ ±0  0 💤 ±0  0 ❌ ±0 

Results for commit f8afac5. ± Comparison against base commit 61d3bb8.

♻️ This comment has been updated with latest results.

[tillrohrmann]

@pullfrog please rebase and review

[pullfrog]

✅ No new issues found.

Rebased onto main (61d3bb8). Since then the PR only replaces the copied job with the reusable workflow and relocks.

• Rebase scope change: main already moved ci.yml and the new pullfrog.yml off the moving taiki-e/install-action@nextest tag to @v2.87.32 with tool: nextest. I resolved the conflict in favor of main's version, so there is still only one locked install-action version. The PR no longer includes the @v2.89.0 bump, and I removed that paragraph from the commit message. The third bullet of the PR description is now stale.
• Lockfile: I checked locally with gh actions-lock --verify (v0.4.0) and all 6 workflows are valid. actions/checkout@v7.0.1 has been dropped, since only the old inline job used it. @v6.1.0 stays because pullfrog.yml uses it.
• Permissions: the caller grants contents: read, which is exactly what the shared job needs. actions/checkout in the called workflow checks out the caller repository, so it still verifies this repo's actions.lock.
• FYI, not blocking: @main is a moving ref, and actions.lock records verify-lockfile.yml: []. Changes to the shared workflow in restatedev/restate therefore take effect here right away, without a relock. This is the intended trade-off for keeping the extension version in one place.

  ^{｜ View workflow run ｜ Using claude-opus-5-5 ｜ 𝕏}